A Federal Rule Already Mandates Recording Every Sales Call. Just Not Yours.

A Federal Rule Already Mandates Recording Every Sales Call. Just Not Yours.

If you run intake or a contact center for a home health, home care, or hospice agency, you have probably been told at some point that HIPAA requires you to record calls. It does not. No provision of the Privacy Rule or the Security Rule obligates a provider to record a patient conversation.

But somewhere in the same market, a federal regulation does impose exactly that obligation — with a defined retention schedule, a defined format, and plan-level enforcement. It applies to third-party marketing organizations working with Medicare Advantage and Part D plans. It is worth reading closely, not because it binds you, but because it is the clearest picture regulators have drawn of what they think a defensible call record looks like.

The rule, in its current form

The TPMO call recording requirement lives at 42 CFR 422.2274(g)(2)(ii). The current text reads:

"All marketing and sales calls, including the audio portion of calls conducted via web-based technology, must be recorded and retained in their entirety for a minimum period of 6 years. For the first 3 years of the retention period, records must be maintained in audio format. For years 4, 5, and 6, records may be maintained in either audio format or as complete and accurate transcript recordings."

There is a mirror provision for Part D at 42 CFR 423.2274(g)(2)(ii), constructed identically.

Four things in that sentence are worth pulling apart, because each one reflects a judgment about what makes a recording useful after the fact.

• "In their entirety." Not the disclosure. Not the first ninety seconds. The whole call. A partial recording is treated as no recording.
• "Including the audio portion of calls conducted via web-based technology." The obligation follows the conversation across channels. Moving a sales conversation to a video platform does not move it outside the rule.
• A tiered format schedule. Audio for three years, then audio or a complete and accurate transcript for years four through six. The regulation distinguishes between what audio proves and what a transcript proves, and only relaxes to text after the window in which the audio itself is likely to matter.
• A floor, not a ceiling. "A minimum period of 6 years."

Who it actually binds

A third-party marketing organization is defined at 42 CFR 422.2260 as organizations and individuals, including independent agents and brokers, "who are compensated to perform lead generation, marketing, sales, and enrollment related functions as a part of the chain of enrollment."

The enforcement structure is indirect and worth understanding. Paragraph (g) of 422.2274 frames these as obligations the MA organization must implement "as a part of their oversight of TPMOs," through contracts, written arrangements, and agreements. The plan is on the hook for ensuring the TPMO complies. That is why an agency that has never thought of itself as a TPMO can still find the requirement arriving through a contract clause: the plan is passing down a duty it cannot discharge on its own.

The same paragraph also requires the TPMO to disclose subcontracted relationships used for marketing, lead generation, and enrollment, to report staff disciplinary actions monthly, and to use a specific disclaimer. That disclaimer language is not in 422.2274 — it lives at 42 CFR 422.2267(e)(41), which prescribes the exact wording and requires it be conveyed verbally within the first minute of a sales call, and separately in email, online chat, on TPMO websites, and in print and television marketing.

Where the sources genuinely disagree

This is an area where the regulation and CMS's own operational guidance are not currently saying the same thing, and anyone relying on it should know that before quoting either one.

The scope has moved twice. The original CY2023 requirement was broad — a CMS marketing FAQ from October 2022 answered the question "is it now a requirement for an agent to record all calls with enrollees, even calls that are outside the scope of the chain of enrollment?" with a flat "Yes." That answer has since been overtaken. The CY2024 final rule narrowed it, under the heading "Limit TPMO Call Recording to Sales, Marketing, and Enrollment," while clarifying that the requirement reaches virtual connections such as video conferencing.

The current CFR text narrows further still: it says marketing and sales calls, and the word "enrollment" no longer appears in that sentence. But CMS's CY2027 Agent and Broker Training and Testing Guidelines still instructs agents to "record all marketing, sales, and enrollment calls, including the audio portion of calls via web-based technology, in their entirety," and adds that "calls other than those involving marketing, sales, and enrollments do not have to be recorded." The guidance also states no retention period, where the regulation now states six years.

The regulation controls. But if you are building a policy against this standard, the conservative reading — record marketing, sales, and enrollment calls — is both defensible and consistent with the guidance CMS is still handing to agents.

There is a second tension worth naming. The recording provision sets a six-year minimum, while 42 CFR 422.504(d) requires the MA organization to "maintain for 10 years books, records, documents, and other evidence of accounting procedures and practices," a list that expressly includes marketing agreements and subcontracts. Different holder, different rule, different clock. Do not state a single retention number for MA-related call recordings without saying which obligation you mean.

What a provider should take from a rule that does not apply to it

Nothing above requires a home health or hospice agency to record a patient call. The Medicare Conditions of Participation do not impose a recording mandate either. Where documentation obligations exist for providers — such as the requirement to document that a patient complaint existed and how it was resolved — they are satisfied by a written record, not by audio. We have written separately about what 484.50(e) actually asks you to produce, and audio is not on that list.

Overstating this is a real risk. "A federal rule requires call recording in Medicare" is a sentence that gets repeated in vendor decks with the qualifier stripped off. The qualifier is the whole sentence.

What is transferable is the specification. CMS, drafting from scratch for a population it considers at risk of being misled on the phone, decided a defensible call record has five properties:

Property	What the rule requires	Provider equivalent worth adopting
Completeness	The call in its entirety	No partial captures; no recording that starts after the disclosure
Channel coverage	Audio of web-based calls included	Coverage follows the conversation, not the phone system
Retention floor	Six years minimum	A written, defended retention period rather than a default
Format integrity	Audio first three years; complete and accurate transcripts thereafter	If transcripts substitute for audio, they must be complete and accurate
Scoped by call type	Marketing and sales calls, not all calls	Categorize calls so obligations attach to the right subset

That last row is the one most agencies are furthest from. A rule that applies to some calls and not others is unenforceable if you cannot tell which call is which. Recording everything and sorting it later is a storage strategy, not a compliance strategy. This is the operational argument for building a call taxonomy that reflects your actual obligations: the categories are what make a scoped rule administrable.

What to do this week

• Check whether any TPMO obligation has already reached you by contract. If your agency does lead generation, referral intake, or enrollment-adjacent work for an MA plan or one of its downstream entities, read the marketing and oversight clauses in that agreement. The duty arrives as a contract term, not as a letter from CMS.
• Separate "we record" from "we can retrieve." Pick three calls from eight months ago and try to produce them, in full, with the date and the handler. The failure mode is almost never the recorder. It is retention settings, a migrated phone system, or a search that only indexes the last ninety days.
• Write down your retention period and the reason for it. One page. What you keep, how long, and which obligation or business purpose sets the clock. Agencies that cannot answer this usually discover they have two answers that conflict.
• Fix the vocabulary in your own policies. If any internal document says HIPAA requires call recording, correct it. Inaccurate compliance claims are their own liability, and they make the accurate ones harder to trust.

Where tooling fits

Rules that attach to some calls and not others require you to know what kind of call each one was — which is a classification problem before it is a storage problem. SurfacerIQ works in the category of call intelligence platforms that categorize healthcare conversations by type and surface the ones that carry obligations. The general capability worth having, from any vendor, is the ability to answer "show me every call of this type in this period" without a manual listen-through.

This post is general information for operators, not legal advice; whether any of these provisions reaches your organization depends on your contracts and your role in the chain of enrollment, which your counsel should assess.

If you are trying to work out which call obligations actually attach to your agency, talk to us.